It's one of the most common assumptions in NZ business IT: 'Microsoft looks after our data.' The reality is more complicated — and potentially costly. Here's what Microsoft actually covers, and what it doesn't.
Key takeaways
- 1Physical data centre security and availability
- 2Platform uptime and infrastructure redundancy
- 3Network and hardware maintenance
- 4Security of the M365 platform itself
Microsoft 365 is the most widely used productivity platform in New Zealand. Exchange Online handles email, OneDrive and SharePoint store files, Teams has replaced the office whiteboard and water cooler conversation alike. For most NZ SMBs, if Microsoft 365 went away tomorrow, so would the business.
So it's understandable — if deeply mistaken — that most business owners assume Microsoft is backing up all of that data. After all, they're paying for a premium service from one of the world's largest technology companies. Surely backup is included?
It isn't. Not in any meaningful sense of the word.
The Shared Responsibility Model
Microsoft publishes something called the Shared Responsibility Model for cloud services. It's not marketing language — it's a formal delineation of what Microsoft is responsible for and what you, as the customer, remain responsible for.
Microsoft's responsibilities include:
- Physical data centre security and availability
- Platform uptime and infrastructure redundancy
- Network and hardware maintenance
- Security of the M365 platform itself
Your responsibilities include:
- Your data and its content
- Account management and access controls
- Protecting data from accidental deletion, malicious action, or corruption
- Ensuring data can be recovered to meet your business and compliance needs
This isn't hidden in fine print. Microsoft's own documentation states clearly that data backup and recovery is the customer's responsibility. The platform will keep running; your data inside it is your problem.
What Microsoft's Retention Tools Actually Do
Microsoft does provide some tools that look like backup but aren't:
- Deleted Items folder: Emails and files deleted by users go here first. It's emptied automatically, typically within 30 days.
- Recycle Bin (SharePoint/OneDrive): Deleted files remain recoverable for up to 93 days across first and second-stage recycle bins.
- Version History: SharePoint and OneDrive maintain file versions, allowing you to restore a previous state. But version history isn't stored indefinitely, and it won't help you if a file is permanently deleted.
- Litigation Hold / eDiscovery: Available in higher-tier M365 licences, these tools preserve data for legal purposes — but they're not designed for operational data recovery.
All of these are useful. None of them are backup. They don't protect you from ransomware that overwrites file versions, from deletions that exceed the retention window, or from the complete removal of a user account and all associated data.
The M365 Service Agreement Is Clear
Microsoft's Service Agreement explicitly excludes liability for data loss. The platform's Service Level Agreement covers uptime — Microsoft will credit your account if the service is unavailable beyond agreed thresholds. It says nothing about recovering your emails, your SharePoint libraries, or your Teams conversations if they are deleted or corrupted.
This isn't a criticism of Microsoft. It's simply how cloud services work. The division of responsibility is reasonable — Microsoft cannot be expected to store unlimited versions of every customer's data indefinitely. But it does mean that responsibility lands squarely with you.
The Consequences for NZ Businesses
New Zealand's Privacy Act 2020 requires organisations to take reasonable steps to protect the personal information they hold. If an M365 data loss event results in a privacy breach — and many do — your ability to demonstrate that you had appropriate protections in place will directly affect your legal exposure.
Beyond compliance, consider the operational reality. Most NZ businesses would struggle to function for more than a day or two without access to their email history, client files, or project documentation. The absence of backup isn't a theoretical risk — it's an existential one.
What Proper M365 Backup Looks Like
A proper M365 backup solution sits outside the Microsoft platform and takes independent, automated copies of your data on a regular schedule — typically daily. It covers Exchange Online mailboxes, SharePoint sites, OneDrive accounts, and Teams data. It stores those copies in separate, immutable storage that cannot be affected by whatever happens inside your M365 tenant.
Critically, it allows granular restore: recovering a single deleted email, a previous version of a SharePoint document, or an entire mailbox to a point in time — without relying on Microsoft's limited retention tools or involving Microsoft support.
If you're not sure whether your M365 data is backed up, the honest answer is probably that it isn't. Optimyze can assess your current configuration and put a solution in place — talk to us today.
